Re: [PATCH] cxl/events: Fix event type check for CME counter expiration

[Dave Jiang <dave.jiang@intel.com>]

On 9/21/26 5:09 AM, Guixin Liu wrote:
> The Memory Event Type field of the General Media and DRAM event
> records is an enumeration; 05h designates the advanced programmable
> CME counter expiration event. The validity checks for that event
> test the field with a bitwise AND against
> CXL_GMER_MEM_EVT_TYPE_AP_CME_COUNTER_EXPIRE instead of comparing it
> for equality, so benign event types that share a bit with 05h, such
> as 01h (Invalid Address), 03h (TE State Violation), 04h (Scrub
> Media ECC Error) or 06h (CKID Violation), match too.
> 
> A device reporting any of those types with an otherwise valid record
> therefore trips WARN_ON_ONCE, once the general media or DRAM
> tracepoint is enabled, which is the case for any deployment
> collecting CXL events with rasdaemon. The warning panics the kernel
> under panic_on_warn=1.
> 
> Compare the type field for equality instead.
> 
> Found by code inspection during review of a downstream backport of
> these two patches. Reproduced in a QEMU CXL topology by injecting a
> General Media event with type 01h through the
> cxl-inject-general-media-event QMP command, which warns in
> cxl_event_trace_record(); with the fix the same injection is traced
> without a warning. Events that do violate the spec conditions, type
> 05h without the threshold event descriptor bit and type 05h with the
> bit set but a zero CME count, still warn.

Please consider using the following simplified commit log:

    The Memory Event Type field in the General Media and DRAM event records
    is an enumeration, not a bitmask. The validity checks for the advanced
    programmable CME counter expiration event (05h) test the field with a
    bitwise AND, so types 01h, 03h, 04h and 06h match it as well.

    A device reporting one of those types trips WARN_ON_ONCE once the
    general media or DRAM tracepoint is enabled, which is the case anywhere
    rasdaemon collects CXL events. Under panic_on_warn=1 that kills the
    machine.

    Compare the type field for equality instead. Type 05h records that do
    violate the spec conditions still warn.

Move the explanation on reproducer under '---'.

Otherwise LGTM

DJ

> 
> Fixes: cd3b36cfc659 ("cxl/events: Add extra validity checks for corrected memory error count in General Media Event Record")
> Fixes: d8145bb8af5c ("cxl/events: Add extra validity checks for CVME count in DRAM Event Record")
> Cc: stable@vger.kernel.org
> Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
> ---
>  drivers/cxl/core/mbox.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/cxl/core/mbox.c b/drivers/cxl/core/mbox.c
> index 55828a836c01..01341f524a93 100644
> --- a/drivers/cxl/core/mbox.c
> +++ b/drivers/cxl/core/mbox.c
> @@ -942,11 +942,11 @@ void cxl_event_trace_record(struct cxl_memdev *cxlmd,
>  
>  			if (evt->gen_media.media_hdr.descriptor &
>  			    CXL_GMER_EVT_DESC_THRESHOLD_EVENT)
> -				WARN_ON_ONCE((evt->gen_media.media_hdr.type &
> +				WARN_ON_ONCE((evt->gen_media.media_hdr.type ==
>  					      CXL_GMER_MEM_EVT_TYPE_AP_CME_COUNTER_EXPIRE) &&
>  					     !get_unaligned_le24(evt->gen_media.cme_count));
>  			else
> -				WARN_ON_ONCE(evt->gen_media.media_hdr.type &
> +				WARN_ON_ONCE(evt->gen_media.media_hdr.type ==
>  					     CXL_GMER_MEM_EVT_TYPE_AP_CME_COUNTER_EXPIRE);
>  
>  			trace_cxl_general_media(cxlmd, type, cxlr, hpa,
> @@ -957,11 +957,11 @@ void cxl_event_trace_record(struct cxl_memdev *cxlmd,
>  
>  			if (evt->dram.media_hdr.descriptor &
>  			    CXL_GMER_EVT_DESC_THRESHOLD_EVENT)
> -				WARN_ON_ONCE((evt->dram.media_hdr.type &
> +				WARN_ON_ONCE((evt->dram.media_hdr.type ==
>  					      CXL_DER_MEM_EVT_TYPE_AP_CME_COUNTER_EXPIRE) &&
>  					     !get_unaligned_le24(evt->dram.cvme_count));
>  			else
> -				WARN_ON_ONCE(evt->dram.media_hdr.type &
> +				WARN_ON_ONCE(evt->dram.media_hdr.type ==
>  					     CXL_DER_MEM_EVT_TYPE_AP_CME_COUNTER_EXPIRE);
>  
>  			trace_cxl_dram(cxlmd, type, cxlr, hpa, hpa_alias,